S3 cross-region replication for DR: setup, RTC, existing objects and failover

#1. Prerequisites

• Versioning enabled on source and destination buckets.
• Destination bucket in the DR region (can be another account, for ransomware isolation).
• IAM role for S3 to replicate; KMS permissions for both keys if objects are SSE-KMS encrypted.

#2. Replication rule

{
  "Role": "arn:aws:iam::111122223333:role/s3-crr-role",
  "Rules": [{
    "ID": "dr-all",
    "Status": "Enabled",
    "Priority": 1,
    "Filter": {},
    "DeleteMarkerReplication": { "Status": "Disabled" },
    "Destination": {
      "Bucket": "arn:aws:s3:::cust-data-dr-aps2",
      "StorageClass": "STANDARD_IA",
      "ReplicationTime": { "Status": "Enabled", "Time": { "Minutes": 15 } },
      "Metrics": { "Status": "Enabled", "EventThreshold": { "Minutes": 15 } }
    },
    "SourceSelectionCriteria": { "SseKmsEncryptedObjects": { "Status": "Enabled" } }
  }]
}

aws s3api put-bucket-replication --bucket cust-data-prod --replication-configuration file://replication.json

(For SSE-KMS objects, add EncryptionConfiguration.ReplicaKmsKeyID with the DR-region key.)

• Replication Time Control (RTC): 99.99% of objects replicated within 15 minutes, with metrics and events. Use it when RPO matters.
• Deleting with DeleteMarkerReplication: Disabled means deletes in production don't hide objects in DR (good for accidental deletion protection).

#3. Existing objects

Replication rules only apply to new objects. Backfill with S3 Batch Replication:

aws s3control create-job --account-id 111122223333 --operation '{"S3ReplicateObject":{}}' \
  --report '{"Enabled":false}' --priority 10 --role-arn arn:aws:iam::111122223333:role/batch-replication \
  --manifest-generator '{"S3JobManifestGenerator":{"SourceBucket":"arn:aws:s3:::cust-data-prod","EnableManifestOutput":false,"Filter":{"EligibleForReplication":true,"ObjectReplicationStatuses":["NONE","FAILED"]}}}' \
  --no-confirmation-required

#4. Monitor

CloudWatch replication metrics: ReplicationLatency, BytesPendingReplication, OperationsFailedReplication. Alert on failed operations.

aws s3api head-object --bucket cust-data-prod --key reports/2026/10/22.csv --query ReplicationStatus

#5. Failover options

• Change application config to the DR bucket name (simple, needs a deploy/config change).
• Multi-Region Access Point with replication in both directions and failover controls: apps use one global endpoint; you set the DR region active in seconds.

#6. Ransomware angle

Replicate to a bucket in a separate backup account with Object Lock, and with replica modification sync off. Compromised credentials in the production account then can't delete the DR copy.